OWASP Docker Security Cheat Sheet

1. Rule 0 Keep Host and Docker Up to Date

   Patching the kernel, Docker engine and runtime.

2. Rule 1 Do Not Expose the Docker Socket

   Risks of mounting docker.sock into containers.

3. Rule 2 Set a User

   Running containers as non-root.

4. Rule 3 Limit Capabilities

   Dropping Linux capabilities.

5. Rule 4 Prevent Privilege Escalation

   no-new-privileges and setuid risks.

6. Rule 5 Inter-Container Connectivity

   Network isolation between containers.

7. Rule 6 Use Linux Security Modules

   Seccomp, AppArmor and SELinux profiles.

8. Rule 7 Limit Resources

   Memory, CPU and process limits.

9. Rule 8 Read-Only Filesystem

   Read-only root filesystems and volumes.

10. Rule 9 Container Scanning

    Image vulnerability scanning in CI/CD.

11. Rule 10 Daemon Logging Level

    Keeping daemon logs useful.

12. Rule 11 Rootless Mode

    Running the daemon without root.

13. Rule 12 Docker Secrets

    Handling secrets without baking them into images.

14. Rule 13 Supply Chain Security

    Trusted base images, signing and provenance.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.